Java Bytecode Delivery in Ivanti EPMM

Tim Peck@timpeck

•updated Feb 10, 2026•3•0•33

Detects attempts to deliver a Base64-encoded Java class to an Ivanti EPMM server. This is characteristic of the "Sleeper Shell" campaign where attackers plant a dormant in-memory backdoor. The rule looks for the Base64 string 'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests targeting the known vulnerable path.